# PhishDestroy domain threat record: guiaemfoco.com.br

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/guiaemfoco.com.br/
Machine-readable companion: https://phishdestroy.io/domain/guiaemfoco.com.br/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-25 08:07:58 UTC
- Last availability or vendor check: 2026-10-22 10:28:50 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 17/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 15.235.57.3
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date (registry RDAP, guiaemfoco.com.br): 2023-12-05 09:49:49 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0d79c-d954-7187-b19e-9d02421d088a/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/guiaemfoco.com.br
- Certificate Transparency search: https://crt.sh/?q=%25.guiaemfoco.com.br
- Web Archive lookup: https://web.archive.org/web/*/https://guiaemfoco.com.br/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
guiaemfoco.com.br presents itself as "Guia em Foco", a Portuguese-language directory promising to help visitors find professionals, companies, places to eat, shop and have fun. PhishDestroy classifies it as an impersonation phishing page aimed at Brazilian users who expect a legitimate local guide. We first flagged it on 2026-09-25. As of 2026-10-19 the site is still online and serving content.

How the scam works
The page title shows an ordinary city-guide homepage, while our classification is impersonation phishing. Schemes of this type borrow the look of a trusted service so visitors lower their guard. They then steer people toward forms or prompts asking for logins, contact details or payment information. Business owners may be offered listings or verification. Visitors may be pushed toward fake offers. Whatever is typed in goes straight to the operators, who can reuse it for account takeover or further fraud.

Evidence
Seventeen of 91 VirusTotal engines flagged the domain on 2026-10-03, including ESET, BitDefender, Fortinet, Forcepoint ThreatSeeker, Emsisoft, alphaMountain.ai, CyRadar and Chong Lua Dao. That is a broad spread of independent vendors for a site posing as a harmless directory. Google Safe Browsing lists it under social engineering, so Chrome and other browsers using that service warn users before the page loads. The domain also appears on the PhishDestroy and PhishFeed blocklists and in five AlienVault OTX threat pulses.

Infrastructure
The domain was registered on 2023-12-05, almost three years before we detected it. An aged domain like this tends to pass reputation filters that catch freshly registered ones. The site is hosted on OVH SAS infrastructure in Canada, far from the Brazilian audience it addresses. It uses a free automated TLS certificate, so the padlock in the browser says nothing about whether the site is legitimate.

What to do
If you entered a password on this site, change it immediately, along with any account where you reused it. Turn on two-factor authentication wherever it is available. If you submitted card or banking details, contact your bank to block the card and dispute unfamiliar charges. Treat follow-up emails, messages or calls that mention Guia em Foco with suspicion. Security teams should block the domain at DNS and proxy level and search logs for users who visited or posted form data to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0d79c-d954-7187-b19e-9d02421d088a/
VirusTotal report: https://www.virustotal.com/gui/domain/guiaemfoco.com.br
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=guiaemfoco.com.br
Archived copy: https://web.archive.org/web/20260925081111/https://guiaemfoco.com.br/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:34:25 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/C34ZtvZb/891bf6e91167.png
  Captured: 2026-09-25 08:10:26 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0d79c-d954-7187-b19e-9d02421d088a.png
  Captured: 2026-09-25 08:10:26 UTC
  Source report: https://urlscan.io/result/01a0d79c-d954-7187-b19e-9d02421d088a/
- URLScan capture 2: https://urlscan.io/screenshots/01a09884-dc86-71ca-b0fd-9ce531e5a27f.png
  Captured: 2026-09-25 08:07:58 UTC
  Source report: https://urlscan.io/result/01a0d79c-d954-7187-b19e-9d02421d088a/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7ac07697-cbe0-4bf7-95f9-79498247c7aa.png
  Captured: 2026-09-25 08:10:20 UTC
  Source report: https://radar.cloudflare.com/scan/7ac07697-cbe0-4bf7-95f9-79498247c7aa
  SHA-256: 1d1e0c8b9b0ee232f595cf73c251a3f41586f5db08d6ba4651fc8b2bf0da80f0
- URLScan · 2026-07-30: https://screenshots.phishdestroy.io/us/019fb31a-eef6-7627-b0fa-6619c44e23e7.png
  Captured: 2026-07-30 12:58:45 UTC
  Source report: https://urlscan.io/result/019fb31a-eef6-7627-b0fa-6619c44e23e7/
  SHA-256: f70e6cd1796539d89fd3af05175ebc23605bca1dfc12837173b691b33b5eda3a
- URLScan · 2026-08-06: https://screenshots.phishdestroy.io/us/019fd885-d73e-72e0-af1e-c2de8a50f1e5.png
  Captured: 2026-08-06 19:21:30 UTC
  Source report: https://urlscan.io/result/019fd885-d73e-72e0-af1e-c2de8a50f1e5/
  SHA-256: 9b0092e62ed3aba3d3291a60f4d5d7888c06850163c92011fc9be9b9a0329723
- URLScan · 2026-08-21: https://screenshots.phishdestroy.io/us/01a02241-8b32-7453-924e-88573eeb53e2.png
  Captured: 2026-08-21 02:58:42 UTC
  Source report: https://urlscan.io/result/01a02241-8b32-7453-924e-88573eeb53e2/
  SHA-256: e3c2df5e714fa71ae27c2a826c728a72a94421690c81840d485b87abe7387502
- URLScan · 2026-08-29: https://screenshots.phishdestroy.io/us/01a04e43-446c-709b-9829-3c4452b665b3.png
  Captured: 2026-08-29 16:03:59 UTC
  Source report: https://urlscan.io/result/01a04e43-446c-709b-9829-3c4452b665b3/
  SHA-256: e3c2df5e714fa71ae27c2a826c728a72a94421690c81840d485b87abe7387502
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0ef78-7f2d-72af-b46a-5dc43ca7e5ad.png
  Captured: 2026-09-29 23:20:54 UTC
  Source report: https://urlscan.io/result/01a0ef78-7f2d-72af-b46a-5dc43ca7e5ad/
  SHA-256: 7beb743624151a0344867da4e078261fc151306406f25aad78a929abaea60572

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:58:16Z",
        "uuid": "01a0d79c-d954-7187-b19e-9d02421d088a",
        "scanned_at": "2026-09-25T08:09:45Z",
        "final_url": "https://www.guiaemfoco.com.br/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://www.guiaemfoco.com.br/",
                "from": "http://www.guiaemfoco.com.br/",
                "status": 307
            }
        ],
        "ip": "15.235.57.3",
        "ptr": "kdkhost.com.br",
        "domains": [
            "fonts.gstatic.com",
            "unpkg.com",
            "cdnjs.cloudflare.com",
            "ajax.googleapis.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.13.94",
            "2a00:1450:4001:c1f::5f",
            "104.18.1.22",
            "104.17.25.14",
            "2a00:1450:4001:c25::5f",
            "15.235.57.3"
        ],
        "asns": [
            "15169",
            "13335",
            "16276"
        ],
        "countries": [
            "US",
            "DE",
            "CA"
        ],
        "link_domains": [
            "maps.google.com",
            "kdkhost.com.br"
        ],
        "doc_hash": "2980555c7d56108a2999be66afc54b31ab5f94f515e2ada2b2e80226b2418481",
        "script_hashes": [
            "0b201e04863919d40c4d85e0f25746cfd332f0cea2e83c756e91edbf52183f6c",
            "b48a91c37472f8061cc64952f51451fe82e330361506b82380027a06789ead96",
            "18c942f1ddc0fd851ea7cfd5afa1e4190f2221d620fa72e4a0c182e8c9dc37d6",
            "ecdaedc69defa51876df4de31031c756a0089616e71ee746f2a7108005be0a94",
            "8216c0087414da0e0ece564add7c6d1a9e77b1dce28a172076061d791f5f61e6",
            "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b",
            "c03425dfda319456dfeef2a6f1d231c167b58bd742763fc819fb102f33685649",
            "57b8f355e3ea30fa4142797bbe08a31a961fb4e42312981473745dcaf8b451c3",
            "c24228dbb311cf9c67365b6de923fef7a761f752375a86612f49543fbf460c67"
        ],
        "globals": [
            "requestResize",
            "$",
            "jQuery",
            "L",
            "gj",
            "home_categories",
            "more_category",
            "Popper",
            "bootstrap",
            "ResizeSensor",
            "jquery_mmenu_all_js",
            "WOW",
            "moment",
            "daterangepicker",
            "qtySum",
            "toastr",
            "MarkerClusterer",
            "Cluster",
            "ClusterIcon",
            "markers",
            "markersData",
            "hideAllMarkers",
            "closeInfoBox",
            "getInfoBox",
            "onHtmlClick",
            "InfoBox",
            "loginAlert",
            "showAjaxModal",
            "confirm_modal",
            "cookieAccept"
        ],
        "cookies": [
            "ci_session"
        ],
        "tls": {
            "san": [
                "*.guiaemfoco.com.br",
                "guiaemfoco.com.br"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "guiaemfoco.com.br",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-07T14:19:17Z",
            "valid_from": "2026-09-08T14:19:18Z"
        },
        "domain_age_days": 3606,
        "apex_age_days": 3606,
        "tls_age_days": 16,
        "tls_valid_days": 89,
        "requests": 46,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": -46,
                "malicious": false
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/7.3.33"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:05:52Z",
        "uuid": "7ac07697-cbe0-4bf7-95f9-79498247c7aa",
        "scanned_at": "2026-09-25T08:10:20Z",
        "final_url": "https://guiaemfoco.com.br/",
        "status": 200,
        "history": [
            {
                "url": "https://guiaemfoco.com.br/",
                "status": 200
            }
        ],
        "dom_hash": "6789fe4c4bb54de7cd0581412297a7f7ff3ebfdcf2a5e349e6544866d84ac732",
        "doc_hash": "14e2d97078001c4283f517f089c717d18e04396a46602f9d393abbb0638ccf52",
        "domain_risks": [
            "Business",
            "Business & Economy"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "guiaemfoco.com.br",
                "type": "A",
                "value": "15.235.57.3"
            }
        ],
        "dnssec_valid": false,
        "ip": "15.235.57.3"
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T18:09:08Z",
        "analysis_at": "2026-10-09T00:57:42Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 17,
            "suspicious": 1,
            "undetected": 30
        },
        "detections": {
            "DNS8": "phishing",
            "ESET": "suspicious",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "malware",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "expires": "2026-12-05T00:00:00Z",
        "first_seen": "2023-12-21T09:25:19Z",
        "dns": [
            {
                "ttl": 14400,
                "type": "TXT",
                "value": "v=spf1 +a +mx +ip4:51.222.153.58 +ip4:15.235.57.3 +ip4:136.243.96.51 ~all"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns2.foco7.com.br"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ns1.foco7.com.br"
            },
            {
                "ttl": 21600,
                "type": "SOA",
                "rname": "cksolucoespa.gmail.com",
                "value": "ns1.foco7.com.br"
            },
            {
                "ttl": 14400,
                "type": "MX",
                "value": "guiaemfoco.com.br",
                "priority": 0
            },
            {
                "ttl": 14400,
                "type": "A",
                "value": "15.235.57.3"
            }
        ],
        "dns_at": "2026-10-09T01:03:06Z",
        "jarm": "29d29d00029d29d00042d43d00041d598ac0c1012db967bb1ad0ff2491b3ae",
        "cert": {
            "san": [
                "*.guiaemfoco.com.br",
                "guiaemfoco.com.br"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6b896a7daaa4774b1803e88e28fd9041a19",
            "sha256": "499ce99ab2955c2d9d4a6f38ae63036d6db919212a009d67ed0be45d16413ca3",
            "subject": "guiaemfoco.com.br",
            "valid_to": "2026-12-07T14:19:17Z",
            "valid_from": "2026-09-08T14:19:18Z"
        }
    }
}
```